Documentation
¶
Overview ¶
Package rust implements the Rust/Cargo ecosystem.Ecosystem, backed by omnibump's RustAnalyzer.
Index ¶
- type Ecosystem
- func (e *Ecosystem) Analyze(ctx context.Context, files map[string][]byte) (*ecosystem.ModuleDeps, error)
- func (e *Ecosystem) BumpCoords(bumps []scan.SecurityBump, _ *ecosystem.ModuleDeps) map[string]scan.SecurityBump
- func (e *Ecosystem) FilterBumps(_ context.Context, existing []string, bumps []scan.SecurityBump, ...) []string
- func (e *Ecosystem) ManifestFiles() []string
- func (e *Ecosystem) Name() string
- func (e *Ecosystem) ScanPackages(deps *ecosystem.ModuleDeps) []scan.Package
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Ecosystem ¶
type Ecosystem struct {
// contains filtered or unexported fields
}
Ecosystem implements ecosystem.Ecosystem for Rust/Cargo projects. omnibump's RustAnalyzer has no checkout-free AnalyzeRemote, so Analyze materializes the fetched Cargo.lock into a real temp directory (via ecosystem.WriteTempFiles) and calls the local Analyze against it.
func (*Ecosystem) BumpCoords ¶
func (e *Ecosystem) BumpCoords(bumps []scan.SecurityBump, _ *ecosystem.ModuleDeps) map[string]scan.SecurityBump
BumpCoords maps each OSV bump to its rendered-grammar coordinate. For Rust the two coincide: OSV names crates exactly as Cargo.lock does, and the rendered grammar is "crate@version", so the coordinate is the crate name.
func (*Ecosystem) FilterBumps ¶
func (e *Ecosystem) FilterBumps(_ context.Context, existing []string, bumps []scan.SecurityBump, deps *ecosystem.ModuleDeps) []string
FilterBumps keeps a candidate bump only when the crate is present in this modroot's Cargo.lock and the candidate version is newer than the highest locked version (Cargo.lock may pin a crate at multiple versions across the dependency graph). This does not replicate omnibump's own per-line semver-constraint resolution (that requires parsing Cargo.toml's caret requirements, which CHOAM doesn't fetch) - it's a simpler "is this newer than what's locked" check, sufficient to decide whether a bump applies.
func (*Ecosystem) ManifestFiles ¶
ManifestFiles returns Cargo.lock only: omnibump's RustAnalyzer.Analyze reads Cargo.lock exclusively and never consults Cargo.toml.
func (*Ecosystem) ScanPackages ¶
func (e *Ecosystem) ScanPackages(deps *ecosystem.ModuleDeps) []scan.Package
Source Files